Skip to content
CVE PROGRAM SOURCE RECORD6.9 Medium

CVE-2026-124726

Apache APISIX: openapi-to-mcp tool call can reach an API path the document does not declare

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
apache

Description

Relative Path Traversal, with Unintended Proxy vulnerability in Apache APISIX. A caller of the MCP endpoint can invoke endpoints the OpenAPI document never declared, under the declared tool's HTTP method, using the credentials the Route adds. This issue affects Apache APISIX: from 3.19.0 before 3.20.0. Users are recommended to upgrade to version 3.20.0, which fixes the issue.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Apache Software Foundation Apache APISIX

Default version status: unaffected

  • 3.19.0 to < 3.20.0affected
pkg:software-id/apache.org/apisix

References